@gajae-code/coding-agent 0.13.0 → 0.13.1

package/src/sdk/bus/conversation-store.ts

@@ -28,6 +28,7 @@ export interface ConversationStoreFs {
 	readFile(file: string, encoding: "utf8"): Promise<string>;
 	writeFile(file: string, data: string, options: { mode: number }): Promise<void>;
 	rename(from: string, to: string): Promise<void>;
+	link(from: string, to: string): Promise<void>;
 	unlink(file: string): Promise<void>;
 	open(file: string, flags: string): Promise<ConversationStoreFileHandle>;
 	stat?(file: string): Promise<{ mtimeMs: number }>;
@@ -46,11 +47,22 @@ export class ConversationLockTimeoutError extends Error {
 interface ConversationStoreLock {
 	pid: number;
 	incarnation: string;
+	isolateId?: string;
 	timestamp: number;
+	/** Uniquely identifies one acquire; lets a release prove it owns the lock file. */
+	nonce?: string;
 }
 
 const nodeFs: ConversationStoreFs = fs;
-const UNPUBLISHED_LOCK_STALE_MS = 30_000;
+/** Unique to this module evaluation, including one Bun worker isolate. */
+const processIsolateId = randomUUID();
+
+/**
+ * Lock files this process currently holds or is acquiring, across every store.
+ * The token lets a releasing predecessor preserve a successor's marker when
+ * the same path has already been reacquired.
+ */
+const heldLockFiles = new Map<string, Set<string>>();
 
 export function conversationStorePath(agentDir: string, kind: string, fileName = "conversations.json"): string {
 	return path.join(agentDir, "sdk", "daemons", kind, fileName);
@@ -214,108 +226,220 @@ export class ConversationStore<T extends ConversationRecord> {
 		const tail = previous.then(() => gate.promise);
 		this.#locks.set(this.#file, tail);
 		await previous;
+		const lockFile = `${this.#file}.lock`;
 		let fileLock: ConversationStoreFileHandle | undefined;
+		let lockToken: ConversationStoreLock | undefined;
 		try {
-			fileLock = await this.#acquireFileLock();
+			const acquired = await this.#acquireFileLock();
+			fileLock = acquired.handle;
+			lockToken = acquired.lock;
 			return await operation();
 		} finally {
 			try {
-				await fileLock?.close();
-				if (fileLock)
-					await this.#fs.unlink(`${this.#file}.lock`).catch(error => {
-						if (!isMissing(error)) throw error;
-					});
+				// A failed close must never skip the unlink: that would leak a
+				// well-formed lock whose pid is still alive and block every later
+				// waiter for the full timeout. The unlink is ownership-checked so
+				// it can only ever remove the lock this holder wrote.
+				if (fileLock) await fileLock.close().catch(() => undefined);
+				if (fileLock && lockToken) await this.#unlinkOwnedLock(lockFile, lockToken);
 			} finally {
+				if (lockToken) this.#releaseHeldLock(lockFile, lockToken);
 				gate.resolve();
 				if (this.#locks.get(this.#file) === tail) this.#locks.delete(this.#file);
 			}
 		}
 	}
 
-	async #acquireFileLock(): Promise<ConversationStoreFileHandle> {
+	#releaseHeldLock(lockFile: string, lock: ConversationStoreLock): void {
+		const tokens = heldLockFiles.get(lockFile);
+		if (!tokens) return;
+		tokens.delete(lock.nonce!);
+		if (tokens.size === 0) heldLockFiles.delete(lockFile);
+	}
+
+	async #unlinkOwnedLock(lockFile: string, expected: ConversationStoreLock): Promise<boolean> {
+		let parsed: unknown;
+		try {
+			parsed = JSON.parse(await this.#fs.readFile(lockFile, "utf8"));
+		} catch (error) {
+			if (isMissing(error)) return false;
+			return false; // unreadable: never remove a lock we cannot identify
+		}
+		if (
+			!isConversationStoreLock(parsed) ||
+			parsed.pid !== expected.pid ||
+			parsed.incarnation !== expected.incarnation ||
+			parsed.isolateId !== expected.isolateId ||
+			parsed.timestamp !== expected.timestamp ||
+			parsed.nonce !== expected.nonce
+		)
+			return false; // a successor holds the path now; leave it
+		try {
+			await this.#fs.unlink(lockFile);
+			return true;
+		} catch (error) {
+			if (isMissing(error)) return false;
+			throw error;
+		}
+	}
+
+	async #acquireFileLock(): Promise<{ handle: ConversationStoreFileHandle; lock: ConversationStoreLock }> {
 		const lockFile = `${this.#file}.lock`;
 		const deadline = Date.now() + this.#lockTimeoutMs;
 		await this.#fs.mkdir(this.#directory, { recursive: true, mode: 0o700 });
 		for (;;) {
 			try {
-				const handle = await this.#fs.open(lockFile, "wx");
-				try {
-					const lock: ConversationStoreLock = {
-						pid: this.#pid,
-						incarnation: this.#pidIncarnation(this.#pid) ?? "unavailable",
-						timestamp: this.#clock(),
-					};
-					await handle.writeFile(`${JSON.stringify(lock)}\n`, "utf8");
-					await handle.sync();
-					return handle;
-				} catch (error) {
-					await handle.close().catch(() => undefined);
-					await this.#fs.unlink(lockFile).catch(() => undefined);
-					throw error;
-				}
+				return await this.#createLockFile(lockFile);
 			} catch (error) {
 				if (!isAlreadyExists(error)) throw error;
 				if (await this.#reclaimStaleLock(lockFile)) continue;
+				if (await this.#reclaimSameProcessLeak(lockFile)) continue;
 				if (Date.now() >= deadline) throw new ConversationLockTimeoutError(lockFile, this.#lockTimeoutMs);
 				await this.#sleep(Math.min(10, Math.max(1, deadline - Date.now())));
 			}
 		}
 	}
 
+	/**
+	 * Removes a well-formed lock this process wrote but no longer holds. Healing
+	 * is serialized by its own ownership-tracked reclaim lock, so concurrent
+	 * waiters cannot delete a successor after the original leak is removed.
+	 */
+	async #reclaimSameProcessLeak(lockFile: string): Promise<boolean> {
+		const expected = await this.#readLock(lockFile);
+		if (
+			!expected ||
+			expected.pid !== this.#pid ||
+			expected.isolateId !== processIsolateId ||
+			heldLockFiles.has(lockFile)
+		)
+			return false;
+
+		const reclaimFile = `${lockFile}.reclaim`;
+		const reclaimLock = await this.#acquireReclaimLock(reclaimFile);
+		if (!reclaimLock) return false;
+		try {
+			if (expected.pid !== this.#pid || expected.isolateId !== processIsolateId || heldLockFiles.has(lockFile))
+				return false;
+			return await this.#unlinkOwnedLock(lockFile, expected);
+		} catch {
+			return false;
+		} finally {
+			await reclaimLock.handle.close().catch(() => undefined);
+			try {
+				await this.#unlinkOwnedLock(reclaimFile, reclaimLock.lock).catch(() => undefined);
+			} finally {
+				this.#releaseHeldLock(reclaimFile, reclaimLock.lock);
+			}
+		}
+	}
+
 	async #reclaimStaleLock(lockFile: string): Promise<boolean> {
 		if (!(await this.#isStaleLock(lockFile))) return false;
 		const reclaimFile = `${lockFile}.reclaim`;
 		const reclaimLock = await this.#acquireReclaimLock(reclaimFile);
 		if (!reclaimLock) return false;
 		try {
-			if (!(await this.#isStaleLock(lockFile))) return false;
-			await this.#fs.unlink(lockFile).catch(() => undefined);
-			return true;
+			const staleLock = await this.#readLock(lockFile);
+			if (!staleLock || !(await this.#isStaleLock(lockFile))) return false;
+			return await this.#unlinkOwnedLock(lockFile, staleLock);
+		} catch {
+			return false;
 		} finally {
-			await reclaimLock.close().catch(() => undefined);
-			await this.#fs.unlink(reclaimFile).catch(() => undefined);
+			await reclaimLock.handle.close().catch(() => undefined);
+			try {
+				await this.#unlinkOwnedLock(reclaimFile, reclaimLock.lock).catch(() => undefined);
+			} finally {
+				this.#releaseHeldLock(reclaimFile, reclaimLock.lock);
+			}
 		}
 	}
-	async #acquireReclaimLock(reclaimFile: string): Promise<ConversationStoreFileHandle | undefined> {
+
+	async #acquireReclaimLock(
+		reclaimFile: string,
+	): Promise<{ handle: ConversationStoreFileHandle; lock: ConversationStoreLock } | undefined> {
 		try {
 			return await this.#createLockFile(reclaimFile);
 		} catch (error) {
-			if (!isAlreadyExists(error) || !(await this.#isStaleLock(reclaimFile))) return undefined;
-			await this.#fs.unlink(reclaimFile).catch(() => undefined);
-			try {
-				return await this.#createLockFile(reclaimFile);
-			} catch (retryError) {
-				if (isAlreadyExists(retryError)) return undefined;
-				throw retryError;
+			if (!isAlreadyExists(error)) return undefined;
+			if (await this.#reclaimStaleLock(reclaimFile)) {
+				try {
+					return await this.#createLockFile(reclaimFile);
+				} catch (retryError) {
+					if (isAlreadyExists(retryError)) return undefined;
+					throw retryError;
+				}
 			}
+			if (await this.#reclaimSameProcessLeak(reclaimFile)) {
+				try {
+					return await this.#createLockFile(reclaimFile);
+				} catch (retryError) {
+					if (isAlreadyExists(retryError)) return undefined;
+					throw retryError;
+				}
+			}
+			return undefined;
 		}
 	}
-	async #createLockFile(lockFile: string): Promise<ConversationStoreFileHandle> {
-		const handle = await this.#fs.open(lockFile, "wx");
+
+	async #createLockFile(
+		lockFile: string,
+	): Promise<{ handle: ConversationStoreFileHandle; lock: ConversationStoreLock }> {
+		const pendingFile = `${lockFile}.${this.#pid}.${randomUUID()}.pending`;
+		const handle = await this.#fs.open(pendingFile, "wx");
+		let lock: ConversationStoreLock | undefined;
+		let published = false;
 		try {
-			const lock: ConversationStoreLock = {
+			lock = {
 				pid: this.#pid,
 				incarnation: this.#pidIncarnation(this.#pid) ?? "unavailable",
+				isolateId: processIsolateId,
 				timestamp: this.#clock(),
+				nonce: randomUUID(),
 			};
+			const heldTokens = heldLockFiles.get(lockFile) ?? new Set<string>();
+			heldTokens.add(lock.nonce!);
+			heldLockFiles.set(lockFile, heldTokens);
 			await handle.writeFile(`${JSON.stringify(lock)}\n`, "utf8");
 			await handle.sync();
-			return handle;
+			await this.#fs.link(pendingFile, lockFile);
+			published = true;
+			await this.#fs.unlink(pendingFile);
+			return { handle, lock };
 		} catch (error) {
-			await handle.close().catch(() => undefined);
-			await this.#fs.unlink(lockFile).catch(() => undefined);
+			try {
+				await handle.close().catch(() => undefined);
+				try {
+					if (published && lock) await this.#unlinkOwnedLock(lockFile, lock);
+				} finally {
+					await this.#fs.unlink(pendingFile).catch(() => undefined);
+				}
+			} finally {
+				if (lock) this.#releaseHeldLock(lockFile, lock);
+			}
 			throw error;
 		}
 	}
+
+	async #readLock(lockFile: string): Promise<ConversationStoreLock | undefined> {
+		try {
+			const parsed: unknown = JSON.parse(await this.#fs.readFile(lockFile, "utf8"));
+			return isConversationStoreLock(parsed) ? parsed : undefined;
+		} catch {
+			return undefined;
+		}
+	}
+
 	async #isStaleLock(lockFile: string): Promise<boolean> {
 		let parsed: unknown;
 		try {
 			parsed = JSON.parse(await this.#fs.readFile(lockFile, "utf8"));
-		} catch (error) {
-			if (isMissing(error)) return true;
-			return await this.#isExpiredUnpublishedLock(lockFile);
+		} catch {
+			// An unreadable legacy marker may still have an open creator. It is
+			// never safe to reclaim it based on age alone.
+			return false;
 		}
-		if (!isConversationStoreLock(parsed)) return await this.#isExpiredUnpublishedLock(lockFile);
+		if (!isConversationStoreLock(parsed)) return false;
 		const currentIncarnation = this.#pidIncarnation(parsed.pid);
 		return (
 			!this.#pidAlive(parsed.pid) ||
@@ -324,10 +448,6 @@ export class ConversationStore<T extends ConversationRecord> {
 					(currentIncarnation !== undefined && currentIncarnation !== parsed.incarnation)))
 		);
 	}
-	async #isExpiredUnpublishedLock(lockFile: string): Promise<boolean> {
-		const stat = this.#fs.stat ? await this.#fs.stat(lockFile).catch(() => undefined) : undefined;
-		return Boolean(stat && this.#clock() - stat.mtimeMs >= UNPUBLISHED_LOCK_STALE_MS);
-	}
 
 	async #readDocument(): Promise<ConversationStoreDocument<T>> {
 		try {
@@ -424,6 +544,7 @@ function isConversationStoreLock(value: unknown): value is ConversationStoreLock
 		Number.isSafeInteger(value.pid) &&
 		value.pid > 0 &&
 		typeof value.incarnation === "string" &&
+		(value.isolateId === undefined || typeof value.isolateId === "string") &&
 		typeof value.timestamp === "number"
 	);
 }

package/src/sdk/bus/index.ts

@@ -1168,6 +1168,8 @@ interface SessionRuntime {
 	cursors: CursorRegistry;
 	/** Current endpoint session identity; never re-key an existing host across a switch. */
 	id: string;
+	/** Discovery scope is fixed before publication; a live default endpoint is never rotated in place. */
+	endpointScope: "default" | "chat";
 	idleSeq: number;
 	/** Interactive asks awaiting a remote answer, by action id. */
 	pendingInteractive: Map<string, PendingInteractiveAsk>;
@@ -1179,6 +1181,8 @@ interface SessionRuntime {
 	disposeGateListener: () => void;
 	/** Whether notification-only delivery and answer resources are active. */
 	notificationsActive: boolean;
+	/** Provider ownership state is independent from the already-published core SDK runtime. */
+	notificationOwnerState: "ready" | "retry" | "blocked";
 	/** Rejects new SDK frames while a leased terminal response drains. */
 	inboundFenced: boolean;
 	/** Set as soon as terminal teardown is requested, before startup settles. */
@@ -2289,12 +2293,12 @@ function sdkQuerySurface(
 	}),
 	configOverrides: ReadonlyMap<string, unknown> = new Map(),
 	settings: Settings | undefined = undefined,
-	promptStatusLookup: (selector: { commandId?: string; turnId?: string; clientRef?: string }) => unknown = () => ({
-		status: "unknown",
-	}),
-	skillStatusLookup: (selector: { commandId?: string; turnId?: string; clientRef?: string }) => unknown = () => ({
-		status: "unknown",
-	}),
+	turnResultLookup: (selector: {
+		kind: "prompt" | "skill";
+		commandId?: string;
+		turnId?: string;
+		clientRef?: string;
+	}) => unknown = () => ({ status: "unknown" }),
 ): SessionSurface {
 	return createSdkSurfaceFactory({
 		ctx,
@@ -2304,8 +2308,7 @@ function sdkQuerySurface(
 		getLiveState,
 		configOverrides,
 		settings,
-		promptStatusLookup,
-		skillStatusLookup,
+		turnResultLookup,
 		hostTools: () => getInstalledDefinitions("host_tools") !== undefined,
 	}).query;
 }
@@ -2941,7 +2944,12 @@ function sdkControlSurface(
 							...(trimmedClientRef ? { clientRef: trimmedClientRef } : {}),
 						});
 					} else if (skillRecon) {
-						void skillRecon.noteTransition(correlation, { type: "agent_end" });
+						void skillRecon.noteTransition(correlation, {
+							type: "agent_end",
+							...(typeof result === "string"
+								? { content: { version: 1, type: "text", text: result, byteLength: 0, truncated: false } }
+								: {}),
+						});
 					}
 					return result;
 				},
@@ -3655,6 +3663,24 @@ export function createNotificationsExtension(
 		await ensureConfiguredProviderDaemons(settings, cfg, options.ensureProviderDaemon);
 		return "ready";
 	}
+
+	function retainNotificationRootRegistration(
+		runtime: SessionRuntime,
+		settings: Settings,
+		cwd: string,
+		id: string,
+		registrationToken: string,
+	): void {
+		if (runtimes.get(id) === runtime && !runtime.stopping) {
+			runtime.notificationRootRegistration = { settings, cwd, registrationToken };
+			return;
+		}
+		runtime.notificationRootRegistration = { settings, cwd, registrationToken };
+		cleanupRetries.set(id, runtime);
+		void stopSession(id, "session", runtime).catch(error =>
+			logger.warn(`notifications: late Telegram root unregister failed: ${String(error)}`),
+		);
+	}
 	const identityControlOperations = new Set([
 		"session.new",
 		"session.fork",
@@ -4150,8 +4176,6 @@ export function createNotificationsExtension(
 		) => {
 			await kindReconciliation.noteAccepted("prompt", correlation, clientRef);
 		};
-		const lookupPromptStatus = (selector: { commandId?: string; turnId?: string; clientRef?: string }) =>
-			kindReconciliation.lookup("prompt", selector);
 		const releasePromptAdmission = (clientRef?: string) => kindReconciliation.releaseAdmission("prompt", clientRef);
 		const removePendingPromptCorrelation = (correlation: { commandId: string; turnId: string }) => {
 			const pendingIndex = pendingPromptCorrelations.findIndex(
@@ -4469,7 +4493,7 @@ export function createNotificationsExtension(
 				}
 			}
 			try {
-				await kindReconciliation.finalizePromptOutcome(correlation, winner, extra?.error);
+				await kindReconciliation.finalizePromptOutcome(correlation, winner, extra?.error, extra?.finalText);
 			} catch (error) {
 				// The durable pending claim survives; publishing an unpersisted terminal
 				// would contradict it, so fail the endpoint closed instead.
@@ -4587,8 +4611,7 @@ export function createNotificationsExtension(
 				},
 				configOverrides,
 				settings,
-				lookupPromptStatus,
-				selector => kindReconciliation.lookup("skill", selector),
+				selector => kindReconciliation.lookupResult(selector.kind, selector),
 			),
 			id,
 			revisions,
@@ -4943,6 +4966,7 @@ export function createNotificationsExtension(
 			revisions,
 			cursors,
 			id,
+			endpointScope: isolateChatEndpoint ? "chat" : "default",
 			idleSeq: 0,
 			pendingInteractive,
 			brokerRegistrationActive: false,
@@ -4953,6 +4977,7 @@ export function createNotificationsExtension(
 			disposeFileSink: () => {},
 			disposeGateListener: () => {},
 			notificationsActive: false,
+			notificationOwnerState: "ready",
 			enableNotifications: () => {},
 			disposeGateTerminalController: () => {},
 			disposeAckRecoveryParticipant: () => {},
@@ -5549,48 +5574,46 @@ export function createNotificationsExtension(
 				await cleanupAbandonedStartup();
 				return { status: "failed" };
 			}
+			// Record canonical identity before transport startup so lifecycle events emitted
+			// by an early server-start callback cannot overtake it in replay. The direct
+			// socket publication remains below, after the server is listening.
+			const identityHeader = {
+				type: "identity_header",
+				sessionId: id,
+				...buildIdentity(ctx.cwd, ctx.sessionManager.getSessionName()),
+			};
+			host.emitEvent({ kind: identityHeader.type, payload: identityHeader });
+			// Core SDK authority is published before optional notification adapters acquire
+			// daemon ownership. A blocked adapter must not make an interactive session
+			// undiscoverable or uncontrollable.
+			const endpoint = await sdkRuntime.startTransport();
+			initializedRuntime.notificationOwnerState = "ready";
 			if (notificationsEnabledForSession && settingsAvailable && settings) {
+				initializedRuntime.notificationOwnerState = "retry";
 				try {
-					let registrationToken: string | undefined;
 					const ownership = await ensureConfiguredDaemonOwners(settings, cfg, ctx.cwd, id, token => {
-						registrationToken = token;
+						retainNotificationRootRegistration(initializedRuntime, settings, ctx.cwd, id, token);
 					});
+					initializedRuntime.notificationOwnerState =
+						ownership === "ready" || (ownership === "blocked_identity_with_sibling" && isolateChatEndpoint)
+							? "ready"
+							: "blocked";
 					if (ownership === "blocked_identity") {
-						const result = failLifecycleStartup("failed", "Telegram daemon ownership is blocked.");
-						finishStartup(result);
-						await cleanupAbandonedStartup();
-						return result;
+						logger.warn("notifications: Telegram daemon ownership is blocked; core SDK remains available.");
 					}
 					if (ownership === "blocked_identity_with_sibling" && !isolateChatEndpoint) {
-						await cleanupAbandonedStartup();
-						if (sessionStartPromises.get(id) === startSettled.promise) sessionStartPromises.delete(id);
-						forceIsolatedChatSessions.add(id);
-						const result = await startSession(ctx);
-						finishStartup(result);
-						return result;
-					}
-					if (registrationToken !== undefined) {
-						runtime.notificationRootRegistration = { settings, cwd: ctx.cwd, registrationToken };
+						logger.warn(
+							"notifications: Telegram ownership changed after core publication; preserving the canonical endpoint and withholding adapters.",
+						);
 					}
 				} catch (error) {
-					const result = failLifecycleStartup("failed", error);
-					finishStartup(result);
-					await cleanupAbandonedStartup();
-					return result;
+					initializedRuntime.notificationOwnerState = "retry";
+					logger.warn(
+						`notifications: provider daemon ownership unavailable; core SDK remains available: ${String(error)}`,
+					);
 				}
 			}
 
-			// Startup contract: configured notification daemon ownership must be ready
-			// before identity or endpoint publication. Native frames are ephemeral, so
-			// publish identity only after readiness; late SDK consumers recover it from
-			// event_replay.
-			const identityHeader = {
-				type: "identity_header",
-				sessionId: id,
-				...buildIdentity(ctx.cwd, ctx.sessionManager.getSessionName()),
-			};
-			host.emitEvent({ kind: identityHeader.type, payload: identityHeader });
-			const endpoint = await sdkRuntime.startTransport();
 			// The native server owns the only authoritative view of this host's live
 			// SDK client sockets; publish it so a detached session host can bound its
 			// own lifetime without probing the OS (#4010). The handle is this
@@ -5849,7 +5872,10 @@ export function createNotificationsExtension(
 	}
 
 	const sessionRuntime: NotificationSessionRuntime<ExtensionContext> = {
-		isRunning: binding => runtimes.get(binding.sessionId)?.notificationsActive === true,
+		isRunning: binding => {
+			const runtime = runtimes.get(binding.sessionId);
+			return runtime?.notificationsActive === true && runtime.notificationOwnerState === "ready";
+		},
 		start: async binding => {
 			if (sessionStartPromises.has(binding.sessionId)) {
 				const result = await startSession(binding.context);
@@ -5862,6 +5888,28 @@ export function createNotificationsExtension(
 			}
 			const runtime = runtimes.get(binding.sessionId);
 			if (runtime) {
+				if (runtime.notificationOwnerState === "retry") {
+					const { cfg, settings, settingsAvailable } = resolveSettings(options.settings);
+					if (!settingsAvailable || !settings) return "failed";
+					try {
+						const ownership = await ensureConfiguredDaemonOwners(
+							settings,
+							cfg,
+							binding.cwd,
+							binding.sessionId,
+							token => {
+								retainNotificationRootRegistration(runtime, settings, binding.cwd, binding.sessionId, token);
+							},
+						);
+						runtime.notificationOwnerState =
+							ownership === "ready" ||
+							(ownership === "blocked_identity_with_sibling" && runtime.endpointScope === "chat")
+								? "ready"
+								: "blocked";
+					} catch {
+						return "failed";
+					}
+				}
 				return "started";
 			}
 			const result = await startSession(binding.context);
@@ -5871,8 +5919,11 @@ export function createNotificationsExtension(
 		isolateTelegram: async binding => {
 			const runtime = runtimes.get(binding.sessionId);
 			if (runtime) {
-				const stopped = await stopSession(binding.sessionId, "session", runtime);
-				if (!stopped || runtimes.has(binding.sessionId) || cleanupRetries.has(binding.sessionId)) return "failed";
+				if (runtime.endpointScope === "default") {
+					runtime.notificationOwnerState = "blocked";
+					return "failed";
+				}
+				return "started";
 			}
 			forceIsolatedChatSessions.add(binding.sessionId);
 			const result = await startSession(binding.context);
@@ -5916,6 +5967,7 @@ export function createNotificationsExtension(
 			// Activation is only valid after the controller commits a stable policy;
 			// never expose deferred presentations while provisional policy is held.
 			if (runtime.policySuspended) return;
+			if (runtime.notificationOwnerState !== "ready") return;
 			runtime.enableNotifications();
 			runtime.gatePresentations?.setPublicationSuspended(false);
 			runtime.gatePresentations?.activateDeferred(runtime.workflowGatePublicationEpoch);
@@ -5942,6 +5994,8 @@ export function createNotificationsExtension(
 						registrationToken,
 					});
 				}
+				if (runtime?.notificationOwnerState === "blocked")
+					runtime.notificationOwnerState = result === "ready" ? "ready" : "blocked";
 				return result;
 			} catch {
 				return "failed";